/
← Voltar ao feed
high

Token-spraying campaign replays post-MFA tokens to compromise Microsoft 365 accounts at 79 organizations via 1337 Services GmbH

2 fonte(s) · 2 atualização(ões) · publicado 22/10/2026 10:00 · coletado há 16 horas

Matéria consolidada. Reúne 2 matérias que o Tifon tinha publicado separadamente sobre a mesma história. A IA reescreveu o relatório com o que as 2 fontes trouxeram em 24/10/2026 00:08; os links antigos trazem para cá.

Fontes: infosecurity-magazine.com ↗ huntress.com ↗

Huntress reported on October 22, 2026 a token replay campaign against Microsoft 365 that ran from July 14 to September 22, 2026. It affected 79 victim organizations and produced 497 sign-in events (huntress.com). The attacker stole post-MFA session tokens through adversary-in-the-middle (AiTM) relays, device-code phishing and social engineering, then replayed them in automated logins that Huntress calls "token spraying". Replay traffic came from the 193.26.115[.]0/24 block of German provider 1337 Services GmbH (AS210558), with more than 200,000 failed login attempts traced to the range (huntress.com). After takeover, the actor wiped and re-registered MFA methods, registered at least 48 rogue Entra devices and created hidden inbox rules, apparently to stage business email compromise (BEC) (huntress.com, infosecurity-magazine.com). In at least one case a payroll-related email was sent to an external CPA (huntress.com). No threat actor is attributed. Microsoft Entra ID Protection independently flagged several of the same IP addresses (huntress.com).

Detalhes técnicos

  • Why MFA is bypassed: tokens are issued after the legitimate login and MFA check, so replaying them needs no password and no new MFA prompt (infosecurity-magazine.com). Attackers were often inside a tenant within minutes of the theft.
  • Two-tier infrastructure: AiTM relays (e.g. 185.238.2[.]195 and an Evoxt Sdn. Bhd. relay) capture the session at the MFA prompt. The session reappears from a 1337 Services address within 4 to 12 minutes (huntress.com).
  • Build A (scripted replay): node or bare Mozilla/5.0 user agent. OAuth2:Token requests use the Microsoft Office and Microsoft Authentication Broker client IDs against Graph, Exchange Online, SharePoint Online and the Device Registration Service. Each sign-in registered a rogue Entra-joined device named DESKTOP- plus 8 uppercase hex characters (48 distinct devices) (huntress.com).
  • Build B (browser session replay): current Chrome/Edge on Windows replaying AiTM-relayed sessions against OfficeHome and Exchange Online (huntress.com).
  • Phases (huntress.com):
    • Phase 1 (Jul 14 to Aug 3, [.]221 and [.]199): 37 organizations compromised and 37 rogue devices registered.
    • Phase 2 (from Aug 17, [.]16 and [.]21): device-code phishing, MFA wipe and re-registration, and a lookalike partner domain.
    • Phase 3 (Sep 11 to 15, [.]72): 303 successful sign-ins across 29 organizations, plus 1,052 sign-ins blocked by Conditional Access in just four organizations.
    • Phase 4 (Sep 2 to 22, [.]210): relay and replay pairing.
  • Persistence: in 19 organizations, existing MFA methods were wiped and a new authenticator (labeled "iPhone 13" in one case) was registered within three hours. Rogue devices give durable token-request capability, so a password reset alone does not evict the actor (huntress.com, infosecurity-magazine.com).
  • Inbox rules: rules named ., sss, s and d moved or deleted mail to folders such as RSS Feeds or Conversation History, keyed on payroll, direct deposit, bank or bonus terms. They were created from VPN or rented hosting (ExpressVPN, NordVPN, CrownCloud, DataWagon, GLOBALTELEHOST, LeaseWeb, Dynu, Interserver), never from 1337 Services, and in four mailboxes via the Outlook REST API (huntress.com).
  • Detection hints: replays of revoked sessions failed with AADSTS50133 (SsoArtifactRevoked). AADSTS53003 blocks indicate the credential was valid (huntress.com).
  • Context: Huntress notes that a 2025 Krebs on Security article suggested the 1337 Services founder may have operated the Cracked forum. This is not an actor attribution (huntress.com).
  • No CVEs are involved, and infosecurity-magazine.com names no threat actor or IOCs.

Remediação

  • Configure Conditional Access Policies to require MFA (or block) for All Users, All Cloud Apps and All Client App types, unconditionally (infosecurity-magazine.com, citing Huntress).
  • If token replay is suspected, revoke sessions and reset passwords. A reset alone is not enough (huntress.com, infosecurity-magazine.com).
  • Audit Entra registered devices (look for DESKTOP- plus 8 hex character names) and MFA methods, and remove unrecognized ones.
  • Review mailboxes for unauthorized inbox rules, especially those touching payroll, direct deposit or bank terms.
  • Hunt for sign-ins from 193.26.115[.]0/24 and the relay addresses listed above.

Relatos divergentes

  • Attempt and success counts: huntress.com describes 497 sign-in events across 79 organizations, with more than 200,000 failed attempts traced to the 1337 Services range. infosecurity-magazine.com says at least 200,000 login attempts, 497 of them successful, and calls the 79 organizations Huntress customers. The two are broadly consistent, but the Huntress original is the more authoritative and detailed.
  • Inbox rule purpose: infosecurity-magazine.com says the rules hid messages from specific contacts. huntress.com, the primary source, says they were keyed on payroll, direct deposit, bank or bonus terms.
  • Payroll email: infosecurity-magazine.com calls it a payroll-related phishing email and says no payment appears to have been received. huntress.com says it went to an external CPA and does not mention an outcome.

Linha do tempo

  1. infosecurity-magazine.com ↗ · pub. 23/10/2026 07:30 · coletado 23/10 09:01

    Token-spraying AiTM campaign hits Microsoft 365 tenants with 200,000+ login attempts, 497 successful, setting up BEC

    ler a análise desta fonte

    Researchers at Huntress uncovered a global business email compromise (BEC) staging campaign against Microsoft 365 environments. Between July and September 2026 it affected 79 Huntress customer organizations. The actor used fake sign-in pages, device-code phishing, adversary-in-the-middle (AiTM) techniques and social engineering to steal session tokens issued after a successful MFA check. It then replayed those tokens in automated "token-spraying" logins. Huntress observed at least 200,000 login attempts, 497 of them successful, with attackers often inside tenants within minutes of stealing a token. Huntress published its findings on October 22.

    Technical Details

    • Stolen tokens are generated after the legitimate login and MFA verification, so replaying them bypasses MFA and requires no password.
    • After access, the attackers wiped victims' MFA settings and registered their own phone or authenticator, so a password reset alone would not evict them.
    • They created hidden inbox rules that moved messages from specific contacts out of sight.
    • They modified Entra settings to register their own devices as legitimate, allowing them to request new tokens later.
    • In one case a compromised mailbox was used to send a payroll-related phishing email; no payment appears to have been received.
    • The article names no threat actor, IOCs or CVEs.

    Remediation

    • Configure Conditional Access Policies to require MFA (or block) for All Users, All Cloud Apps and All Client App types, unconditionally (Huntress).
    • If token replay is suspected, revoke sessions and reset the password.
    • Audit Entra registered devices and MFA methods.
    • Review inbox rules for unauthorized changes.
  2. huntress.com ↗ · pub. 22/10/2026 10:00 · coletado 22/10 11:01 primeiro registro

    Token spray and replay campaign compromises M365 accounts at 79 organizations via 1337 Services GmbH infrastructure

    ler a análise desta fonte

    Between July 14 and September 22, 2026, Huntress detected 497 Microsoft 365 sign-in events across 79 victim organizations in a token replay campaign. The attacker replayed post-MFA session tokens stolen through AiTM relays, device-code phishing and social engineering, a pattern Huntress calls "token spraying". Replay traffic came from the 193.26.115[.]0/24 block hosted by German provider 1337 Services GmbH (AS210558), with more than 200,000 failed login attempts traced to the range. After takeover, the actor wiped and re-registered MFA methods, registered at least 48 rogue Entra devices and created hidden inbox rules. In at least one case they sent a payroll-related email to an external CPA. Microsoft Entra ID Protection independently flagged several of the same IP addresses.

    Technical Details

    • Two-tier infrastructure: AiTM relays (e.g. 185.238.2[.]195, and an Evoxt Sdn. Bhd. relay) capture the session at the MFA prompt. The session then reappears from a 1337 Services address within 4 to 12 minutes.
    • Build A (scripted replay): node or bare Mozilla/5.0 user agent, OAuth2:Token requests using the Microsoft Office and Microsoft Authentication Broker client IDs against Graph, Exchange Online, SharePoint Online and the Device Registration Service. Each sign-in registered a rogue Entra-joined device named DESKTOP- plus 8 uppercase hex characters (48 distinct devices).
    • Build B (browser session replay): current Chrome/Edge on Windows replaying sessions from AiTM relays against OfficeHome and Exchange Online.
    • Phases:
      • Phase 1 (Jul 14 to Aug 3, [.]221 and [.]199): 37 organizations compromised and 37 rogue devices registered.
      • Phase 2 (from Aug 17, [.]16 and [.]21): device-code phishing, MFA wipe and re-registration, lookalike partner domain.
      • Phase 3 (Sep 11 to 15, [.]72): 303 successful sign-ins across 29 organizations, plus 1,052 sign-ins blocked by Conditional Access in just four organizations.
      • Phase 4 (Sep 2 to 22, [.]210): relay and replay pairing.
    • Persistence: in 19 organizations, existing MFA methods were wiped and a new authenticator (labeled "iPhone 13" in one case) was registered within three hours. Rogue devices give durable token-request capability.
    • Inbox rules: rules named ., sss, s and d moved or deleted mail to folders such as RSS Feeds or Conversation History, keyed on payroll, direct deposit, bank or bonus terms. They were created from VPN or rented hosting (ExpressVPN, NordVPN, CrownCloud, DataWagon, GLOBALTELEHOST, LeaseWeb, Dynu, Interserver), never from 1337 Services, and in four mailboxes via the Outlook REST API.
    • Replays of revoked sessions failed with AADSTS50133 (SsoArtifactRevoked). AADSTS53003 blocks indicate a valid credential.
    • Huntress notes that a 2025 Krebs on Security article suggested the 1337 Services founder may have operated the Cracked forum. No actor attribution is made.

    Remediation

    • Revoke sessions and reset passwords. A reset alone removes neither rogue devices nor MFA methods, and the access token lives about 90 minutes.
    • Audit Entra devices (DESKTOP-, Device- or Work Pc plus 8 hex characters) and MFA methods, removing unrecognized ones.
    • Review inbox rules with short or punctuation-only names or payroll and banking keywords.
    • Enforce Conditional Access requiring MFA or block for all users, cloud apps and client app types. Restrict device-code flow. Treat AADSTS53003 blocks as evidence of a valid credential.
    • Prioritize response by credential validity, not spray volume.
    • Hunt for OAuth2:Token and Cmsi:Cmsi sign-ins from hosting infrastructure with node or bare Mozilla/5.0 user agents, and for new enterprise applications. Consider blocking the full 193.26.115[.]0/24.